IPS slows down my Internet connection since some days

Question

Hi, 
 I recognized yesterday that my download speed is not as fast as it should be. I've a 120/6 Mbit/s line and during downloads I reach only about 50-60 Mbit/s. Upload is fine. So I did some further investigations and found out, that IPS is the problem. After disabling IPS on the UTM the download speed was fine. 
 I enabled IPS again and took a look into the logs, CPU and MEM load, but I can't find any hints what could cause the problem. I've disabled all checks in IPS (signatures, TCP and UDP flooding, port scanning...) without disabling IPS itself, but the download speed was still "slow". 
 I'm sure that last week the download speed was OK with IPS enabled. What could happend? 
 BTW: Since I've my UTM I've never seen any IPS matches in the logs and/or overview. That's strange in my opinion. Maybe my ISP is filtering this packets befor they can reache the UTM. 
 Jas

BAlfson · Accepted Answer

IPS is single-threaded, so the number of rules it checks can have a dramatic effect on throughput, as you've noticed. 
 Cheers - Bob

sachingurung · Answer

Hi Jas, 
 Implementing IPS will by default effect the bandwidth. It is because packets are deep scanned and verified withing the ips engine which consumes bandwidth. 
 Refer the guide here and fine tune the IPS configurations. 
 
 Thanks

Jas Man · Answer

The rule age was the problem. It stood on "< 24 months". I can't remember that I've changed this value in the last weeks, but since I've set it back to "< 12 months" the speed is just fine. 
 I still do not understand why IPS slows down the speed, when the CPU and MEM have no high load. 
 But.....the main thing is, that it works now as expected. 
 
 Thank you!